a73x

5b03e25b

test: e2e — (a) asserts the second marker ABSENT before ssh dies

a73x   2026-08-11 18:46

Commit message
test: e2e — (a) asserts the second marker ABSENT before ssh dies

Correction to bde1af5, from the spec review. That commit added the
post-hoc half of the ordering proof and called it done; the half that
actually closes the hole was missing.

The hole had a real failure mode behind it. Both markers are typed by a
script running on its own clock, in parallel with the attach. If an attach
ever took longer than the 6s between them, both would be typed before the
session existed, both would be delivered out of the carry buffer the
moment it did, and cold-two would already be in the capture when the
client killed ssh. Every check in the scenario would then pass — pid
observed dead, marker observed present, pid still dead — while proving
nothing whatsoever about bytes moving after the pipe's owner died.

So the marker is now asserted ABSENT immediately before the death is
observed. That fixes the ORDER; the post-hoc kill -0 fixes the DURATION
and rules out pid reuse. Each comment names which property it carries,
because neither implies the other and a reader who thinks it does will
delete the wrong one.

A failure of the new check is this scenario's timing premise breaking —
an attach slower than 6s against ~300ms observed — not a product defect,
and the message says so rather than blaming the code.

Checked in situ rather than assumed: pointed at "cold-one", which IS
present at that moment, the check fires with its own message and the run
goes red. Restored to "cold-two", the suite is green at 20 scenarios / 33
convergence points.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/e2e.sh
Old New
@@ -2315,19 +2315,37 @@ HSHIMS=$(wc -l < "$SSHIM_PIDLOG")
2315 echo "e2e FAIL: cold handoff ran $HSHIMS ssh invocations, want exactly 1" 2315 echo "e2e FAIL: cold handoff ran $HSHIMS ssh invocations, want exactly 1"
2316 cat "$SSHIM_PIDLOG"; exit 1; } 2316 cat "$SSHIM_PIDLOG"; exit 1; }
2317 HSHIMPID=$(head -1 "$SSHIM_PIDLOG") 2317 HSHIMPID=$(head -1 "$SSHIM_PIDLOG")
2318 # The BASELINE, and it is what makes the pair below an ordering proof
2319 # rather than two independent facts: the second marker must not have
2320 # arrived YET. Without it the scenario has a hole with a real failure mode
2321 # behind it — if an attach ever took longer than the script's 6s sleep,
2322 # both markers would be typed before the session existed, both would be
2323 # delivered out of the carry buffer at attach, and cold-two would already
2324 # be in the capture when ssh was killed. Every check below would then pass
2325 # while proving nothing about bytes moving AFTER the pipe's owner died.
2326 #
2327 # A failure here is the scenario's own premise breaking (an attach slower
2328 # than 6s against ~300ms observed), not a product defect, and it says so.
2329 grep -q "cold-two" "$OUT.h1" && {
2330 echo "e2e FAIL: cold handoff: the second marker arrived before ssh was killed,"
2331 echo " so it cannot witness QUIC carrying the session. The attach was"
2332 echo " slower than this scenario's 6s script — a timing premise broke,"
2333 echo " not necessarily the product."
2334 exit 1; }
2318 wait_pid_gone "$HSHIMPID" "cold handoff: QUIC took over, so ssh must be gone" 2335 wait_pid_gone "$HSHIMPID" "cold handoff: QUIC took over, so ssh must be gone"
2319 # ...and the session did not go with it. 2336 # ...and the session did not go with it.
2320 wait_for "$OUT.h1" "cold-two" 20 || { 2337 wait_for "$OUT.h1" "cold-two" 20 || {
2321 echo "e2e FAIL: cold handoff: the session stopped converging once ssh was gone," 2338 echo "e2e FAIL: cold handoff: the session stopped converging once ssh was gone,"
2322 echo " so the bytes were riding the pipe rather than QUIC" 2339 echo " so the bytes were riding the pipe rather than QUIC"
2323 cat "$OUT.h1" "$OUT.h1.err" 2>/dev/null; exit 1; } 2340 cat "$OUT.h1" "$OUT.h1.err" 2>/dev/null; exit 1; }
2324 # Dead at one INSTANT is not the claim this scenario makes; dead across the 2341 # The other half, and it pins a different property from the baseline
2325 # whole WINDOW is. The wait above proves the pid was gone before the second 2342 # above. That one fixes the ORDER — the marker had not arrived when ssh
2326 # marker was typed, and this proves it stayed gone while that marker made 2343 # died, so its later arrival is post-death traffic. This one fixes the
2327 # its round trip — so nothing could have carried those bytes on the pipe 2344 # DURATION: dead at one instant is not the claim, dead across the whole
2328 # for any part of the journey. Cheap, and it closes the only reading under 2345 # window is, so the pid is re-observed now that the round trip is complete.
2329 # which the observation above and the marker below are both true of a 2346 # It also rules out the pid having been reused by an unrelated process
2330 # session still riding ssh. 2347 # mid-window, which the single observation could not distinguish from a
2348 # corpse.
2331 kill -0 "$HSHIMPID" 2>/dev/null && { 2349 kill -0 "$HSHIMPID" 2>/dev/null && {
2332 echo "e2e FAIL: cold handoff: ssh pid $HSHIMPID is alive again after the second" 2350 echo "e2e FAIL: cold handoff: ssh pid $HSHIMPID is alive again after the second"
2333 echo " marker; the death observed earlier was not the whole window" 2351 echo " marker; the death observed earlier was not the whole window"